---
title: "List the privacy clauses in an AI vendor contract"
url: "https://ailawframework.com/practice/privacy-data-protection-and-cyber/conduct-ai-product-due-diligence-for-privacy/united-states"
type: "task_jurisdiction_version"
site: "AI Law Framework"
id: "A25-B6-2-US"
practice_area: "Privacy, Data Protection & Cyber"
tier: "yellow"
lawyer_review: "required"
jurisdictions: ["US"]
last_reviewed: "2026-10-22"
---

# List the privacy clauses in an AI vendor contract

> From the contract the lawyer supplies, copy the clauses on categories, purposes, sale or sharing, service-provider limits, notice if the vendor can no longer meet its obligations, and security measures, with the page…

Canonical page: https://ailawframework.com/practice/privacy-data-protection-and-cyber/conduct-ai-product-due-diligence-for-privacy/united-states  
Last reviewed: 2026-10-22

Site index for agents: https://ailawframework.com/llms.txt

## Key facts

| Fact | Value |
| --- | --- |
| Practice area | [Privacy, Data Protection & Cyber](https://ailawframework.com/practice/privacy-data-protection-and-cyber.md) |
| Human involvement | Yellow: Lawyer and AI draft together |
| How AI is used | From the contract the lawyer supplies, copy the clauses on categories, purposes, sale or sharing, service-provider limits, notice if the vendor can no longer meet its obligations, and security measures, with the page of each. Write no due-diligence opinion. |
| What the lawyer must review | Section 1798.100(d) requires a business that collects personal information and sells or shares it with a third party, or discloses it to a service provider or contractor for a business purpose, to enter an agreement that limits the purposes, requires the same level of privacy protection, gives the business steps to help ensure consistent use, requires notice if the recipient can no longer meet its obligations, and gives the business a right, upon notice, to stop and remediate unauthorized use. Subsection (e) requires reasonable security, in accordance with section 1798.81.5, which was not opened. The clause list does not decide that the vendor is a service provider or that the agreement meets subsection (d). Opinion 512 and Model Rule 1.6. |
| Written for | United States |
| Applies to | [Conduct AI product due diligence for privacy](https://ailawframework.com/practice/privacy-data-protection-and-cyber/conduct-ai-product-due-diligence-for-privacy.md) |

## Checking plan

- What the AI does: From the contract the lawyer supplies, copy the clauses on categories, purposes, sale or sharing, service-provider limits, notice if the vendor can no longer meet its obligations, and security measures, with the page of each. Write no due-diligence opinion.
- Basis: Checked against the linked sources on 22 October 2026. Confirm the current instrument before reliance.

## Notes

- A service-provider clause is not a HIPAA business-associate agreement. Open that regime only if it applies.
- Do not treat a missing clause as a breach of contract. That conclusion is yours.

## Sources

- [California Civil Code section 1798.100 (duties of businesses that collect personal information)](https://leginfo.legislature.ca.gov/faces/codes_displaySection.xhtml?lawCode=CIV&sectionNum=1798.100.) (checked 2026-10-22)
- [ABA Formal Opinion 512, Generative Artificial Intelligence Tools (29 July 2024)](https://www.americanbar.org/content/dam/aba/administrative/professional_responsibility/ethics-opinions/aba-formal-opinion-512.pdf) (checked 2026-10-22)
- [ABA Model Rule 1.6, Confidentiality of Information](https://www.americanbar.org/groups/professional_responsibility/publications/model_rules_of_professional_conduct/rule_1_6_confidentiality_of_information/) (checked 2026-10-22)

*Practice guidance for planning and review. Confirm current primary sources and the requirements of the actual matter. This is general information, not legal advice.*